Remove Session serialize/deserialize methods to fix RCE vulnerability

The Session.deserialize method used Oj.load without safe mode, which allows
   instantiation of arbitrary Ruby objects. If an attacker could control session
   storage (e.g., compromise a Redis instance or database), they could inject
   malicious serialized data to achieve remote code execution.

   These methods were vestigial code from when the library handled session
   storage (deprecated in v12.3.0). After that deprecation, apps became
   responsible for their own session persistence, rendering serialize/deserialize
   unnecessary for their original purpose. Investigation confirmed no external
   usage - the shopify_app gem stores individual session attributes in database
   columns and reconstructs sessions using Session.new().

   The only internal usage was copy_attributes_from, which called serialize just
   to enumerate attribute names via JSON.parse(other.serialize).keys before
   copying instance variables. This has been refactored to directly copy each
   attribute, eliminating the dependency on serialize.

   Breaking change: Session#serialize and Session.deserialize removed.
   Migration: Apps should use Session.new() to reconstruct sessions from stored
   attributes (the pattern already used by shopify_app).

   Complete removal eliminates the RCE vector entirely while maintaining all
   functionality.